A dedicated browser (profile) for online banking

Question

I have a dedicated browser (Firefox) profile that I use for accessing online banking systems (and only for that). The current setup is (summarising) as follows:

1. I have it set to clear all history and cookies when closing the browser.
2. I have a master password set up to protect saved passwords (in addition to all my browser profiles being separately encrypted).
3. I have bookmarked all the banking sites that I want to use (so I never have to google them or anything of the sort).
4. I have the cookie whitelist extension, so that I don't get any cookies I don't explicitly allow.
5. I have NoScript, so that only the sites I allow can run any scripts.
6. I have Self-Destructing Cookies, so that the cookies erase themselves after I close their tabs.
7. I have RememberPass, so that I can save passwords even in those sites that won't let me.
8. I don't keep the passwords online, I only copy them between computers offline via an encrypted file on a USB stick/via local network/manually.

One thing I have an obvious problem with are those silly sites that have me input only select characters from the password. The only way I see to type those in with extreme hassle is to have an encrypted file with numbered characters in each password, but that is still a bit of a hassle and doesn't feel as secure as I'd like it to be (in particular, I have the text file open on my screen and I have to painstakingly input every character, which might leave me open to shoulder surfing if I'm less careful).

So the question is: are there any obvious ways in which I can improve the setup (without crippling usability, I'm not that rich or paranoid)? Perhaps there is another browser better suited for the job, or some extensions that might help with security or usability (see esp. the previous paragraph)?

I use similar profiles in both Linux and Windows.

Answer 1

Your setup seems to take precautions against the banking site itself (NoScript, no cookies, etc), the issue is that site would be relatively safe (and if not, it's the bank's problem, not yours).

On the other hand, malware caught by browsing in your other, non-banking browser would still be free to spy on you and observe anything you do in the banking browser once it owns your entire user account.

If you do want to protect your online banking I suggest you do so on an isolated computer where you do nothing but banking (no way to catch malware through other sites, etc). If you do not have a second computer you can do all your non-sensitive activities in a VM, which if compromised should provide good enough isolation to prevent compromise of the host where you do sensitive activities. Note that doing the opposite (non-sensitive stuff on the host, sensitive stuff in a VM) will do nothing because the host has full access to the VMs by design, so once the host is owned, so are the VMs.

Answer 2

Dedicating a whole computer to Internet banking is a bit too much, therefore I would advise you to download another browser, Opera for example, to secure it and to use it only for banking. Malware infecting Firefox won't be active in the other browser.

Tor browser is also a good alternative.

If you want to keep Firefox, I would suggest a USB key with Firefox portable edition, installed and secured and used only for I Banking. It is a good solution as your data will be available on your computer only when the USB key is in.

If you are afraid of keyloggers you can use a key scrambler.